@effect-kit/storage 0.0.0-stage → 0.0.0

package/dist/runtime/bun-filesystem.js

@@ -0,0 +1,136 @@
+import { ByteSize, Effect, FileSystem, Layer, Option, Schema } from "effect";
+import { constants } from "node:fs";
+import { open } from "node:fs/promises";
+import * as BunFileSystem from "@effect/platform-bun/BunFileSystem";
+import { badArgument, systemError } from "effect/PlatformError";
+
+// src/runtime/bun-filesystem.ts
+const Errno = Schema.Struct({ code: Schema.optional(Schema.String) });
+const categories = {
+	ENOENT: "NotFound",
+	EEXIST: "AlreadyExists",
+	EACCES: "PermissionDenied",
+	EPERM: "PermissionDenied",
+	EBADF: "BadResource",
+	EBUSY: "Busy",
+	EINVAL: "InvalidData",
+	EAGAIN: "WouldBlock"
+};
+const io = (method, run) => Effect.tryPromise({
+	try: run,
+	catch: (error) => {
+		const decoded = Schema.decodeUnknownOption(Errno)(error);
+		const code = Option.isSome(decoded) ? decoded.value.code : void 0;
+		return systemError({
+			module: "FileSystem",
+			method,
+			_tag: code ? categories[code] ?? "Unknown" : "Unknown"
+		});
+	}
+}).pipe(Effect.uninterruptible);
+const positionNumber = (position) => position >= 0n && position <= BigInt(Number.MAX_SAFE_INTEGER) ? Effect.succeed(Number(position)) : Effect.fail(badArgument({
+	module: "FileSystem",
+	method: "position",
+	description: "Unsupported file offset"
+}));
+const info = (stat) => ({
+	type: stat.isFile() ? "File" : stat.isDirectory() ? "Directory" : stat.isSymbolicLink() ? "SymbolicLink" : stat.isBlockDevice() ? "BlockDevice" : stat.isCharacterDevice() ? "CharacterDevice" : stat.isFIFO() ? "FIFO" : stat.isSocket() ? "Socket" : "Unknown",
+	mtime: Option.some(stat.mtime),
+	atime: Option.some(stat.atime),
+	birthtime: Option.some(stat.birthtime),
+	dev: BigInt.asUintN(64, stat.dev),
+	ino: Option.some(BigInt.asUintN(64, stat.ino)),
+	mode: Number(stat.mode),
+	nlink: Option.some(BigInt.asUintN(64, stat.nlink)),
+	uid: Option.some(Number(stat.uid)),
+	gid: Option.some(Number(stat.gid)),
+	rdev: Option.some(BigInt.asUintN(64, stat.rdev)),
+	size: ByteSize.bytes(stat.size),
+	blksize: Option.some(ByteSize.bytes(stat.blksize)),
+	blocks: Option.some(stat.blocks)
+});
+const flags = {
+	r: constants.O_RDONLY,
+	"r+": constants.O_RDWR,
+	w: constants.O_WRONLY | constants.O_CREAT | constants.O_TRUNC,
+	"w+": constants.O_RDWR | constants.O_CREAT | constants.O_TRUNC,
+	wx: constants.O_WRONLY | constants.O_CREAT | constants.O_TRUNC | constants.O_EXCL,
+	"wx+": constants.O_RDWR | constants.O_CREAT | constants.O_TRUNC | constants.O_EXCL,
+	a: constants.O_WRONLY | constants.O_CREAT | constants.O_APPEND,
+	"a+": constants.O_RDWR | constants.O_CREAT | constants.O_APPEND,
+	ax: constants.O_WRONLY | constants.O_CREAT | constants.O_APPEND | constants.O_EXCL,
+	"ax+": constants.O_RDWR | constants.O_CREAT | constants.O_APPEND | constants.O_EXCL
+};
+const openFile = Effect.fnUntraced(function* (filename, options) {
+	const flag = options?.flag ?? "r";
+	if (options?.noFollow && (process.platform === "win32" || !constants.O_NOFOLLOW)) return yield* badArgument({
+		module: "FileSystem",
+		method: "open",
+		description: "noFollow is unavailable"
+	});
+	const native = yield* Effect.acquireRelease(io("open", () => open(filename, options?.noFollow ? flags[flag] | constants.O_NOFOLLOW : flag, options?.mode)), (file) => io("close", () => file.close()).pipe(Effect.orDie));
+	let cursor = 0n;
+	const append = flag.startsWith("a");
+	const read = Effect.fnUntraced(function* (buffer, readOptions) {
+		const position = readOptions?.position ?? cursor;
+		const offset = yield* positionNumber(position);
+		const result = yield* io("read", () => native.read(buffer, 0, buffer.length, offset));
+		if (readOptions?.position === void 0) cursor = position + BigInt(result.bytesRead);
+		return result.bytesRead;
+	});
+	const write = Effect.fnUntraced(function* (buffer) {
+		const offset = yield* positionNumber(cursor);
+		const result = yield* io("write", () => native.write(buffer, 0, buffer.length, append ? null : offset));
+		if (!append) cursor += BigInt(result.bytesWritten);
+		return result.bytesWritten;
+	});
+	return {
+		[FileSystem.FileTypeId]: FileSystem.FileTypeId,
+		stat: io("stat", () => native.stat({ bigint: true })).pipe(Effect.map(info)),
+		sync: io("sync", () => native.sync()),
+		seek: (offset, from) => Effect.gen(function* () {
+			const position = from === "start" ? offset : cursor + offset;
+			yield* positionNumber(position);
+			cursor = position;
+			return position;
+		}),
+		read,
+		readAlloc: (size, readOptions) => Effect.gen(function* () {
+			if (!Number.isSafeInteger(size) || size < 0) return yield* badArgument({
+				module: "FileSystem",
+				method: "readAlloc"
+			});
+			const buffer = new Uint8Array(size);
+			const count = yield* read(buffer, readOptions);
+			return count === 0 ? Option.none() : Option.some(buffer.subarray(0, count));
+		}),
+		truncate: (length = 0) => Effect.gen(function* () {
+			if (!Number.isSafeInteger(length) || length < 0) return yield* badArgument({
+				module: "FileSystem",
+				method: "truncate"
+			});
+			yield* io("truncate", () => native.truncate(length));
+			if (cursor > BigInt(length)) cursor = BigInt(length);
+		}),
+		write,
+		writeAll: (bytes) => Effect.gen(function* () {
+			let offset = 0;
+			while (offset < bytes.length) {
+				const count = yield* write(bytes.subarray(offset));
+				if (count === 0) return yield* systemError({
+					module: "FileSystem",
+					method: "writeAll",
+					_tag: "WriteZero"
+				});
+				offset += count;
+			}
+		})
+	};
+});
+const layer = Layer.effect(FileSystem.FileSystem, Effect.map(FileSystem.FileSystem, (fs) => FileSystem.make({
+	...fs,
+	open: openFile
+}))).pipe(Layer.provide(BunFileSystem.layer));
+
+export { layer };
+//# sourceMappingURL=bun-filesystem.js.map

package/dist/runtime/bun-filesystem.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bun-filesystem.js","names":[],"sources":["../../src/runtime/bun-filesystem.ts"],"sourcesContent":["import { constants } from \"node:fs\";\nimport type { BigIntStats } from \"node:fs\";\nimport { open } from \"node:fs/promises\";\n\nimport * as BunFileSystem from \"@effect/platform-bun/BunFileSystem\";\nimport { ByteSize, Effect, FileSystem, Layer, Option, Schema } from \"effect\";\nimport { badArgument, systemError } from \"effect/PlatformError\";\nimport type { SystemErrorTag } from \"effect/PlatformError\";\n\nconst Errno = Schema.Struct({ code: Schema.optional(Schema.String) });\nconst categories: Readonly<Record<string, SystemErrorTag>> = {\n  ENOENT: \"NotFound\",\n  EEXIST: \"AlreadyExists\",\n  EACCES: \"PermissionDenied\",\n  EPERM: \"PermissionDenied\",\n  EBADF: \"BadResource\",\n  EBUSY: \"Busy\",\n  EINVAL: \"InvalidData\",\n  EAGAIN: \"WouldBlock\",\n};\nconst io = <A>(method: string, run: () => Promise<A>) =>\n  Effect.tryPromise({\n    try: run,\n    catch: (error) => {\n      const decoded = Schema.decodeUnknownOption(Errno)(error);\n      const code = Option.isSome(decoded) ? decoded.value.code : undefined;\n      return systemError({\n        module: \"FileSystem\",\n        method,\n        _tag: code ? (categories[code] ?? \"Unknown\") : \"Unknown\",\n      });\n    },\n  }).pipe(Effect.uninterruptible);\n\nconst positionNumber = (position: bigint) =>\n  position >= 0n && position <= BigInt(Number.MAX_SAFE_INTEGER)\n    ? Effect.succeed(Number(position))\n    : Effect.fail(\n        badArgument({\n          module: \"FileSystem\",\n          method: \"position\",\n          description: \"Unsupported file offset\",\n        }),\n      );\n\nconst info = (stat: BigIntStats): FileSystem.File.Info => ({\n  type: stat.isFile()\n    ? \"File\"\n    : stat.isDirectory()\n      ? \"Directory\"\n      : stat.isSymbolicLink()\n        ? \"SymbolicLink\"\n        : stat.isBlockDevice()\n          ? \"BlockDevice\"\n          : stat.isCharacterDevice()\n            ? \"CharacterDevice\"\n            : stat.isFIFO()\n              ? \"FIFO\"\n              : stat.isSocket()\n                ? \"Socket\"\n                : \"Unknown\",\n  mtime: Option.some(stat.mtime),\n  atime: Option.some(stat.atime),\n  birthtime: Option.some(stat.birthtime),\n  dev: BigInt.asUintN(64, stat.dev),\n  ino: Option.some(BigInt.asUintN(64, stat.ino)),\n  mode: Number(stat.mode),\n  nlink: Option.some(BigInt.asUintN(64, stat.nlink)),\n  uid: Option.some(Number(stat.uid)),\n  gid: Option.some(Number(stat.gid)),\n  rdev: Option.some(BigInt.asUintN(64, stat.rdev)),\n  size: ByteSize.bytes(stat.size),\n  blksize: Option.some(ByteSize.bytes(stat.blksize)),\n  blocks: Option.some(stat.blocks),\n});\nconst flags: Readonly<Record<FileSystem.OpenFlag, number>> = {\n  r: constants.O_RDONLY,\n  \"r+\": constants.O_RDWR,\n  w: constants.O_WRONLY | constants.O_CREAT | constants.O_TRUNC,\n  \"w+\": constants.O_RDWR | constants.O_CREAT | constants.O_TRUNC,\n  wx: constants.O_WRONLY | constants.O_CREAT | constants.O_TRUNC | constants.O_EXCL,\n  \"wx+\": constants.O_RDWR | constants.O_CREAT | constants.O_TRUNC | constants.O_EXCL,\n  a: constants.O_WRONLY | constants.O_CREAT | constants.O_APPEND,\n  \"a+\": constants.O_RDWR | constants.O_CREAT | constants.O_APPEND,\n  ax: constants.O_WRONLY | constants.O_CREAT | constants.O_APPEND | constants.O_EXCL,\n  \"ax+\": constants.O_RDWR | constants.O_CREAT | constants.O_APPEND | constants.O_EXCL,\n};\n\n// Bun 1.4.4 ignores Effect's undefined-offset write overload and bigint read positions.\n// Explicit offset/length/number calls preserve the public FileSystem contract without patching globals.\nconst openFile: FileSystem.FileSystem[\"open\"] = Effect.fnUntraced(function* (filename, options) {\n  const flag = options?.flag ?? \"r\";\n  if (options?.noFollow && (process.platform === \"win32\" || !constants.O_NOFOLLOW))\n    return yield* badArgument({\n      module: \"FileSystem\",\n      method: \"open\",\n      description: \"noFollow is unavailable\",\n    });\n  const native = yield* Effect.acquireRelease(\n    io(\"open\", () =>\n      open(filename, options?.noFollow ? flags[flag] | constants.O_NOFOLLOW : flag, options?.mode),\n    ),\n    (file) => io(\"close\", () => file.close()).pipe(Effect.orDie),\n  );\n  let cursor = 0n;\n  const append = flag.startsWith(\"a\");\n  const read: FileSystem.File[\"read\"] = Effect.fnUntraced(function* (buffer, readOptions) {\n    const position = readOptions?.position ?? cursor;\n    const offset = yield* positionNumber(position);\n    const result = yield* io(\"read\", () => native.read(buffer, 0, buffer.length, offset));\n    if (readOptions?.position === undefined) cursor = position + BigInt(result.bytesRead);\n    return result.bytesRead;\n  });\n  const write: FileSystem.File[\"write\"] = Effect.fnUntraced(function* (buffer) {\n    const offset = yield* positionNumber(cursor);\n    const result = yield* io(\"write\", () =>\n      native.write(buffer, 0, buffer.length, append ? null : offset),\n    );\n    if (!append) cursor += BigInt(result.bytesWritten);\n    return result.bytesWritten;\n  });\n  const file: FileSystem.File = {\n    [FileSystem.FileTypeId]: FileSystem.FileTypeId,\n    stat: io(\"stat\", () => native.stat({ bigint: true })).pipe(Effect.map(info)),\n    sync: io(\"sync\", () => native.sync()),\n    seek: (offset, from) =>\n      Effect.gen(function* () {\n        const position = from === \"start\" ? offset : cursor + offset;\n        yield* positionNumber(position);\n        cursor = position;\n        return position;\n      }),\n    read,\n    readAlloc: (size, readOptions) =>\n      Effect.gen(function* () {\n        if (!Number.isSafeInteger(size) || size < 0)\n          return yield* badArgument({ module: \"FileSystem\", method: \"readAlloc\" });\n        const buffer = new Uint8Array(size);\n        const count = yield* read(buffer, readOptions);\n        return count === 0 ? Option.none() : Option.some(buffer.subarray(0, count));\n      }),\n    truncate: (length = 0) =>\n      Effect.gen(function* () {\n        if (!Number.isSafeInteger(length) || length < 0)\n          return yield* badArgument({ module: \"FileSystem\", method: \"truncate\" });\n        yield* io(\"truncate\", () => native.truncate(length));\n        if (cursor > BigInt(length)) cursor = BigInt(length);\n      }),\n    write,\n    writeAll: (bytes) =>\n      Effect.gen(function* () {\n        let offset = 0;\n        while (offset < bytes.length) {\n          const count = yield* write(bytes.subarray(offset));\n          if (count === 0)\n            return yield* systemError({\n              module: \"FileSystem\",\n              method: \"writeAll\",\n              _tag: \"WriteZero\",\n            });\n          offset += count;\n        }\n      }),\n  };\n  return file;\n});\n\nexport const layer = Layer.effect(\n  FileSystem.FileSystem,\n  Effect.map(FileSystem.FileSystem, (fs) => FileSystem.make({ ...fs, open: openFile })),\n).pipe(Layer.provide(BunFileSystem.layer));\n"],"mappings":";;;;;;;AASA,MAAM,QAAQ,OAAO,OAAO,EAAE,MAAM,OAAO,SAAS,OAAO,MAAM,EAAE,CAAC;AACpE,MAAM,aAAuD;CAC3D,QAAQ;CACR,QAAQ;CACR,QAAQ;CACR,OAAO;CACP,OAAO;CACP,OAAO;CACP,QAAQ;CACR,QAAQ;AACV;AACA,MAAM,MAAS,QAAgB,QAC7B,OAAO,WAAW;CAChB,KAAK;CACL,QAAQ,UAAU;EAChB,MAAM,UAAU,OAAO,oBAAoB,KAAK,CAAC,CAAC,KAAK;EACvD,MAAM,OAAO,OAAO,OAAO,OAAO,IAAI,QAAQ,MAAM,OAAO;EAC3D,OAAO,YAAY;GACjB,QAAQ;GACR;GACA,MAAM,OAAQ,WAAW,SAAS,YAAa;EACjD,CAAC;CACH;AACF,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe;AAEhC,MAAM,kBAAkB,aACtB,YAAY,MAAM,YAAY,OAAO,OAAO,gBAAgB,IACxD,OAAO,QAAQ,OAAO,QAAQ,CAAC,IAC/B,OAAO,KACL,YAAY;CACV,QAAQ;CACR,QAAQ;CACR,aAAa;AACf,CAAC,CACH;AAEN,MAAM,QAAQ,UAA6C;CACzD,MAAM,KAAK,OAAO,IACd,SACA,KAAK,YAAY,IACf,cACA,KAAK,eAAe,IAClB,iBACA,KAAK,cAAc,IACjB,gBACA,KAAK,kBAAkB,IACrB,oBACA,KAAK,OAAO,IACV,SACA,KAAK,SAAS,IACZ,WACA;CAChB,OAAO,OAAO,KAAK,KAAK,KAAK;CAC7B,OAAO,OAAO,KAAK,KAAK,KAAK;CAC7B,WAAW,OAAO,KAAK,KAAK,SAAS;CACrC,KAAK,OAAO,QAAQ,IAAI,KAAK,GAAG;CAChC,KAAK,OAAO,KAAK,OAAO,QAAQ,IAAI,KAAK,GAAG,CAAC;CAC7C,MAAM,OAAO,KAAK,IAAI;CACtB,OAAO,OAAO,KAAK,OAAO,QAAQ,IAAI,KAAK,KAAK,CAAC;CACjD,KAAK,OAAO,KAAK,OAAO,KAAK,GAAG,CAAC;CACjC,KAAK,OAAO,KAAK,OAAO,KAAK,GAAG,CAAC;CACjC,MAAM,OAAO,KAAK,OAAO,QAAQ,IAAI,KAAK,IAAI,CAAC;CAC/C,MAAM,SAAS,MAAM,KAAK,IAAI;CAC9B,SAAS,OAAO,KAAK,SAAS,MAAM,KAAK,OAAO,CAAC;CACjD,QAAQ,OAAO,KAAK,KAAK,MAAM;AACjC;AACA,MAAM,QAAuD;CAC3D,GAAG,UAAU;CACb,MAAM,UAAU;CAChB,GAAG,UAAU,WAAW,UAAU,UAAU,UAAU;CACtD,MAAM,UAAU,SAAS,UAAU,UAAU,UAAU;CACvD,IAAI,UAAU,WAAW,UAAU,UAAU,UAAU,UAAU,UAAU;CAC3E,OAAO,UAAU,SAAS,UAAU,UAAU,UAAU,UAAU,UAAU;CAC5E,GAAG,UAAU,WAAW,UAAU,UAAU,UAAU;CACtD,MAAM,UAAU,SAAS,UAAU,UAAU,UAAU;CACvD,IAAI,UAAU,WAAW,UAAU,UAAU,UAAU,WAAW,UAAU;CAC5E,OAAO,UAAU,SAAS,UAAU,UAAU,UAAU,WAAW,UAAU;AAC/E;AAIA,MAAM,WAA0C,OAAO,WAAW,WAAW,UAAU,SAAS;CAC9F,MAAM,OAAO,SAAS,QAAQ;CAC9B,IAAI,SAAS,aAAa,QAAQ,aAAa,WAAW,CAAC,UAAU,aACnE,OAAO,OAAO,YAAY;EACxB,QAAQ;EACR,QAAQ;EACR,aAAa;CACf,CAAC;CACH,MAAM,SAAS,OAAO,OAAO,eAC3B,GAAG,cACD,KAAK,UAAU,SAAS,WAAW,MAAM,QAAQ,UAAU,aAAa,MAAM,SAAS,IAAI,CAC7F,IACC,SAAS,GAAG,eAAe,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,KAAK,CAC7D;CACA,IAAI,SAAS;CACb,MAAM,SAAS,KAAK,WAAW,GAAG;CAClC,MAAM,OAAgC,OAAO,WAAW,WAAW,QAAQ,aAAa;EACtF,MAAM,WAAW,aAAa,YAAY;EAC1C,MAAM,SAAS,OAAO,eAAe,QAAQ;EAC7C,MAAM,SAAS,OAAO,GAAG,cAAc,OAAO,KAAK,QAAQ,GAAG,OAAO,QAAQ,MAAM,CAAC;EACpF,IAAI,aAAa,aAAa,QAAW,SAAS,WAAW,OAAO,OAAO,SAAS;EACpF,OAAO,OAAO;CAChB,CAAC;CACD,MAAM,QAAkC,OAAO,WAAW,WAAW,QAAQ;EAC3E,MAAM,SAAS,OAAO,eAAe,MAAM;EAC3C,MAAM,SAAS,OAAO,GAAG,eACvB,OAAO,MAAM,QAAQ,GAAG,OAAO,QAAQ,SAAS,OAAO,MAAM,CAC/D;EACA,IAAI,CAAC,QAAQ,UAAU,OAAO,OAAO,YAAY;EACjD,OAAO,OAAO;CAChB,CAAC;CA4CD,OAAO;GA1CJ,WAAW,aAAa,WAAW;EACpC,MAAM,GAAG,cAAc,OAAO,KAAK,EAAE,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,IAAI,CAAC;EAC3E,MAAM,GAAG,cAAc,OAAO,KAAK,CAAC;EACpC,OAAO,QAAQ,SACb,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,SAAS,UAAU,SAAS,SAAS;GACtD,OAAO,eAAe,QAAQ;GAC9B,SAAS;GACT,OAAO;EACT,CAAC;EACH;EACA,YAAY,MAAM,gBAChB,OAAO,IAAI,aAAa;GACtB,IAAI,CAAC,OAAO,cAAc,IAAI,KAAK,OAAO,GACxC,OAAO,OAAO,YAAY;IAAE,QAAQ;IAAc,QAAQ;GAAY,CAAC;GACzE,MAAM,SAAS,IAAI,WAAW,IAAI;GAClC,MAAM,QAAQ,OAAO,KAAK,QAAQ,WAAW;GAC7C,OAAO,UAAU,IAAI,OAAO,KAAK,IAAI,OAAO,KAAK,OAAO,SAAS,GAAG,KAAK,CAAC;EAC5E,CAAC;EACH,WAAW,SAAS,MAClB,OAAO,IAAI,aAAa;GACtB,IAAI,CAAC,OAAO,cAAc,MAAM,KAAK,SAAS,GAC5C,OAAO,OAAO,YAAY;IAAE,QAAQ;IAAc,QAAQ;GAAW,CAAC;GACxE,OAAO,GAAG,kBAAkB,OAAO,SAAS,MAAM,CAAC;GACnD,IAAI,SAAS,OAAO,MAAM,GAAG,SAAS,OAAO,MAAM;EACrD,CAAC;EACH;EACA,WAAW,UACT,OAAO,IAAI,aAAa;GACtB,IAAI,SAAS;GACb,OAAO,SAAS,MAAM,QAAQ;IAC5B,MAAM,QAAQ,OAAO,MAAM,MAAM,SAAS,MAAM,CAAC;IACjD,IAAI,UAAU,GACZ,OAAO,OAAO,YAAY;KACxB,QAAQ;KACR,QAAQ;KACR,MAAM;IACR,CAAC;IACH,UAAU;GACZ;EACF,CAAC;CAEK;AACZ,CAAC;AAED,MAAa,QAAQ,MAAM,OACzB,WAAW,YACX,OAAO,IAAI,WAAW,aAAa,OAAO,WAAW,KAAK;CAAE,GAAG;CAAI,MAAM;AAAS,CAAC,CAAC,CACtF,CAAC,CAAC,KAAK,MAAM,QAAQ,cAAc,KAAK,CAAC"}

package/dist/runtime/file-target.d.ts

@@ -0,0 +1,10 @@
+import { StorageError } from "../core/errors.js";
+import { TransferHash } from "../transfers/dependencies.js";
+import { RestartableDownloadTarget } from "../sessions/download.js";
+import { Effect, FileSystem, Path } from "effect";
+import { Digest } from "effect/crypto";
+export declare const fileDownloadTarget: (options: {
+  readonly id: string;
+  readonly path: string;
+}) => Effect.Effect<RestartableDownloadTarget<StorageError, never>, StorageError, Digest.Digest | FileSystem.FileSystem | Path.Path | TransferHash>;
+//# sourceMappingURL=file-target.d.ts.map

package/dist/runtime/file-target.js

@@ -0,0 +1,66 @@
+import { TransferHash } from "../transfers/dependencies.js";
+import { sameChecksum } from "../transfers/reader.js";
+import { SessionId } from "../sessions/checkpoint.js";
+import { sessionError } from "../sessions/store.js";
+import { syncDirectory } from "./filesystem.js";
+import { ByteSize, Effect, FileSystem, Path, Schema, Stream } from "effect";
+import { Digest } from "effect/crypto";
+
+// src/runtime/file-target.ts
+const mutate = (effect) => effect.pipe(Effect.uninterruptible, Effect.mapError(() => sessionError("SessionFileIO")));
+const fileDownloadTarget = Effect.fnUntraced(function* (options) {
+	const fs = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const digest = yield* TransferHash;
+	const identities = yield* Digest.Digest;
+	const input = yield* Schema.decodeUnknownEffect(Schema.Struct({
+		id: SessionId,
+		path: Schema.NonEmptyString
+	}))(options).pipe(Effect.mapError(() => sessionError("InvalidDownloadTarget")));
+	const destination = path.resolve(input.path);
+	const partial = `${destination}.${input.id}.partial`;
+	const identity = yield* identities.digestHex(Digest.sha256, new TextEncoder().encode(`${input.id}\0${destination}\0${partial}`));
+	const verify = Effect.fnUntraced(function* (filename, expected, length) {
+		const info = yield* fs.stat(filename);
+		if (ByteSize.toBigInt(info.size) !== BigInt(length)) return yield* sessionError("PartialLengthMismatch");
+		const hash = digest.create();
+		yield* Stream.runForEach(fs.stream(filename, { chunkSize: 65536 }), (bytes) => Effect.sync(() => hash.update(bytes)));
+		if (!sameChecksum(hash.finish(), expected)) return yield* sessionError("PartialIntegrityMismatch");
+	});
+	return {
+		id: input.id,
+		identity,
+		prefix: (length) => length === 0 ? Stream.empty : fs.stream(partial, {
+			bytesToRead: length,
+			chunkSize: 65536
+		}).pipe(Stream.mapError(() => sessionError("PartialRead"))),
+		truncate: (length) => mutate(Effect.scoped(Effect.gen(function* () {
+			const handle = yield* fs.open(partial, {
+				flag: length === 0 ? "a+" : "r+",
+				mode: 384
+			});
+			if (ByteSize.toBigInt((yield* handle.stat).size) < BigInt(length)) return yield* sessionError("PartialTooShort");
+			yield* handle.truncate(length);
+			yield* handle.sync;
+		})).pipe(Effect.andThen(syncDirectory(fs, path.dirname(destination))))),
+		write: (offset, bytes) => mutate(Effect.scoped(Effect.gen(function* () {
+			const handle = yield* fs.open(partial, { flag: "r+" });
+			yield* handle.seek(BigInt(offset), "start");
+			yield* handle.writeAll(bytes);
+		}))),
+		sync: mutate(Effect.scoped(Effect.flatMap(fs.open(partial, { flag: "r+" }), (handle) => handle.sync)).pipe(Effect.andThen(syncDirectory(fs, path.dirname(destination))))),
+		publish: (checksum, length) => mutate(Effect.gen(function* () {
+			if (!(yield* fs.exists(partial))) {
+				yield* verify(destination, checksum, length);
+				return;
+			}
+			yield* verify(partial, checksum, length);
+			yield* fs.rename(partial, destination);
+			yield* syncDirectory(fs, path.dirname(destination));
+		})),
+		discard: () => mutate(fs.remove(partial, { force: true }).pipe(Effect.andThen(syncDirectory(fs, path.dirname(destination)))))
+	};
+});
+
+export { fileDownloadTarget };
+//# sourceMappingURL=file-target.js.map

package/dist/runtime/file-target.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-target.js","names":[],"sources":["../../src/runtime/file-target.ts"],"sourcesContent":["import { ByteSize, Effect, FileSystem, Path, Schema, Stream } from \"effect\";\nimport { Digest } from \"effect/crypto\";\n\nimport type { StorageError } from \"../core/errors.js\";\nimport type { Checksum } from \"../core/object.js\";\nimport { SessionId } from \"../sessions/checkpoint.js\";\nimport type { RestartableDownloadTarget } from \"../sessions/download.js\";\nimport { sessionError } from \"../sessions/store.js\";\nimport { TransferHash } from \"../transfers/dependencies.js\";\nimport { sameChecksum } from \"../transfers/reader.js\";\nimport { syncDirectory } from \"./filesystem.js\";\n\n// Platform IO may be non-cancellable: join issued writes before releasing ownership.\nconst mutate = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n  effect.pipe(\n    Effect.uninterruptible,\n    Effect.mapError(() => sessionError(\"SessionFileIO\")),\n  );\n\nexport const fileDownloadTarget = Effect.fnUntraced(function* (options: {\n  readonly id: string;\n  readonly path: string;\n}) {\n  const fs = yield* FileSystem.FileSystem;\n  const path = yield* Path.Path;\n  const digest = yield* TransferHash;\n  const identities = yield* Digest.Digest;\n  const input = yield* Schema.decodeUnknownEffect(\n    Schema.Struct({ id: SessionId, path: Schema.NonEmptyString }),\n  )(options).pipe(Effect.mapError(() => sessionError(\"InvalidDownloadTarget\")));\n  const destination = path.resolve(input.path);\n  const partial = `${destination}.${input.id}.partial`;\n  const identity = yield* identities.digestHex(\n    Digest.sha256,\n    new TextEncoder().encode(`${input.id}\\0${destination}\\0${partial}`),\n  );\n\n  const verify = Effect.fnUntraced(function* (\n    filename: string,\n    expected: Checksum,\n    length: number,\n  ) {\n    const info = yield* fs.stat(filename);\n    if (ByteSize.toBigInt(info.size) !== BigInt(length))\n      return yield* sessionError(\"PartialLengthMismatch\");\n    const hash = digest.create();\n    yield* Stream.runForEach(fs.stream(filename, { chunkSize: 65536 }), (bytes) =>\n      Effect.sync(() => hash.update(bytes)),\n    );\n    if (!sameChecksum(hash.finish(), expected))\n      return yield* sessionError(\"PartialIntegrityMismatch\");\n  });\n  const target: RestartableDownloadTarget<StorageError> = {\n    id: input.id,\n    identity,\n    prefix: (length) =>\n      length === 0\n        ? Stream.empty\n        : fs\n            .stream(partial, { bytesToRead: length, chunkSize: 65536 })\n            .pipe(Stream.mapError(() => sessionError(\"PartialRead\"))),\n    truncate: (length) =>\n      mutate(\n        Effect.scoped(\n          Effect.gen(function* () {\n            const handle = yield* fs.open(partial, {\n              flag: length === 0 ? \"a+\" : \"r+\",\n              mode: 0o600,\n            });\n            if (ByteSize.toBigInt((yield* handle.stat).size) < BigInt(length))\n              return yield* sessionError(\"PartialTooShort\");\n            yield* handle.truncate(length);\n            yield* handle.sync;\n          }),\n        ).pipe(Effect.andThen(syncDirectory(fs, path.dirname(destination)))),\n      ),\n    write: (offset, bytes) =>\n      mutate(\n        Effect.scoped(\n          Effect.gen(function* () {\n            const handle = yield* fs.open(partial, { flag: \"r+\" });\n            yield* handle.seek(BigInt(offset), \"start\");\n            yield* handle.writeAll(bytes);\n          }),\n        ),\n      ),\n    sync: mutate(\n      Effect.scoped(Effect.flatMap(fs.open(partial, { flag: \"r+\" }), (handle) => handle.sync)).pipe(\n        Effect.andThen(syncDirectory(fs, path.dirname(destination))),\n      ),\n    ),\n    publish: (checksum, length) =>\n      mutate(\n        Effect.gen(function* () {\n          if (!(yield* fs.exists(partial))) {\n            yield* verify(destination, checksum, length);\n            return;\n          }\n          yield* verify(partial, checksum, length);\n          yield* fs.rename(partial, destination);\n          yield* syncDirectory(fs, path.dirname(destination));\n        }),\n      ),\n    discard: () =>\n      mutate(\n        fs\n          .remove(partial, { force: true })\n          .pipe(Effect.andThen(syncDirectory(fs, path.dirname(destination)))),\n      ),\n  };\n  return target;\n});\n"],"mappings":";;;;;;;;;AAaA,MAAM,UAAmB,WACvB,OAAO,KACL,OAAO,iBACP,OAAO,eAAe,aAAa,eAAe,CAAC,CACrD;AAEF,MAAa,qBAAqB,OAAO,WAAW,WAAW,SAG5D;CACD,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,OAAO,OAAO,KAAK;CACzB,MAAM,SAAS,OAAO;CACtB,MAAM,aAAa,OAAO,OAAO;CACjC,MAAM,QAAQ,OAAO,OAAO,oBAC1B,OAAO,OAAO;EAAE,IAAI;EAAW,MAAM,OAAO;CAAe,CAAC,CAC9D,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,aAAa,uBAAuB,CAAC,CAAC;CAC5E,MAAM,cAAc,KAAK,QAAQ,MAAM,IAAI;CAC3C,MAAM,UAAU,GAAG,YAAY,GAAG,MAAM,GAAG;CAC3C,MAAM,WAAW,OAAO,WAAW,UACjC,OAAO,QACP,IAAI,YAAY,CAAC,CAAC,OAAO,GAAG,MAAM,GAAG,IAAI,YAAY,IAAI,SAAS,CACpE;CAEA,MAAM,SAAS,OAAO,WAAW,WAC/B,UACA,UACA,QACA;EACA,MAAM,OAAO,OAAO,GAAG,KAAK,QAAQ;EACpC,IAAI,SAAS,SAAS,KAAK,IAAI,MAAM,OAAO,MAAM,GAChD,OAAO,OAAO,aAAa,uBAAuB;EACpD,MAAM,OAAO,OAAO,OAAO;EAC3B,OAAO,OAAO,WAAW,GAAG,OAAO,UAAU,EAAE,WAAW,MAAM,CAAC,IAAI,UACnE,OAAO,WAAW,KAAK,OAAO,KAAK,CAAC,CACtC;EACA,IAAI,CAAC,aAAa,KAAK,OAAO,GAAG,QAAQ,GACvC,OAAO,OAAO,aAAa,0BAA0B;CACzD,CAAC;CA2DD,OAAO;EAzDL,IAAI,MAAM;EACV;EACA,SAAS,WACP,WAAW,IACP,OAAO,QACP,GACG,OAAO,SAAS;GAAE,aAAa;GAAQ,WAAW;EAAM,CAAC,CAAC,CAC1D,KAAK,OAAO,eAAe,aAAa,aAAa,CAAC,CAAC;EAChE,WAAW,WACT,OACE,OAAO,OACL,OAAO,IAAI,aAAa;GACtB,MAAM,SAAS,OAAO,GAAG,KAAK,SAAS;IACrC,MAAM,WAAW,IAAI,OAAO;IAC5B,MAAM;GACR,CAAC;GACD,IAAI,SAAS,UAAU,OAAO,OAAO,KAAI,CAAE,IAAI,IAAI,OAAO,MAAM,GAC9D,OAAO,OAAO,aAAa,iBAAiB;GAC9C,OAAO,OAAO,SAAS,MAAM;GAC7B,OAAO,OAAO;EAChB,CAAC,CACH,CAAC,CAAC,KAAK,OAAO,QAAQ,cAAc,IAAI,KAAK,QAAQ,WAAW,CAAC,CAAC,CAAC,CACrE;EACF,QAAQ,QAAQ,UACd,OACE,OAAO,OACL,OAAO,IAAI,aAAa;GACtB,MAAM,SAAS,OAAO,GAAG,KAAK,SAAS,EAAE,MAAM,KAAK,CAAC;GACrD,OAAO,OAAO,KAAK,OAAO,MAAM,GAAG,OAAO;GAC1C,OAAO,OAAO,SAAS,KAAK;EAC9B,CAAC,CACH,CACF;EACF,MAAM,OACJ,OAAO,OAAO,OAAO,QAAQ,GAAG,KAAK,SAAS,EAAE,MAAM,KAAK,CAAC,IAAI,WAAW,OAAO,IAAI,CAAC,CAAC,CAAC,KACvF,OAAO,QAAQ,cAAc,IAAI,KAAK,QAAQ,WAAW,CAAC,CAAC,CAC7D,CACF;EACA,UAAU,UAAU,WAClB,OACE,OAAO,IAAI,aAAa;GACtB,IAAI,EAAE,OAAO,GAAG,OAAO,OAAO,IAAI;IAChC,OAAO,OAAO,aAAa,UAAU,MAAM;IAC3C;GACF;GACA,OAAO,OAAO,SAAS,UAAU,MAAM;GACvC,OAAO,GAAG,OAAO,SAAS,WAAW;GACrC,OAAO,cAAc,IAAI,KAAK,QAAQ,WAAW,CAAC;EACpD,CAAC,CACH;EACF,eACE,OACE,GACG,OAAO,SAAS,EAAE,OAAO,KAAK,CAAC,CAAC,CAChC,KAAK,OAAO,QAAQ,cAAc,IAAI,KAAK,QAAQ,WAAW,CAAC,CAAC,CAAC,CACtE;CAEQ;AACd,CAAC"}

package/dist/runtime/filesystem.d.ts

@@ -0,0 +1,6 @@
+import { Effect, FileSystem, Path } from "effect";
+import { Digest, SecureRandom } from "effect/crypto";
+import { KeyValueStore } from "effect/persistence";
+/** Private trusted root; the application owns cross-process exclusion. */
+export declare const atomicFileStore: (directory: string) => Effect.Effect<KeyValueStore.KeyValueStore, KeyValueStore.KeyValueStoreError, Digest.Digest | FileSystem.FileSystem | Path.Path | SecureRandom.SecureRandom>;
+//# sourceMappingURL=filesystem.d.ts.map

package/dist/runtime/filesystem.js

@@ -0,0 +1,68 @@
+import { ByteSize, Effect, Exit, FileSystem, Path } from "effect";
+import { Digest, SecureRandom } from "effect/crypto";
+import { KeyValueStore } from "effect/persistence";
+
+// src/runtime/filesystem.ts
+const syncDirectory = (fs, directory) => Effect.scoped(Effect.flatMap(fs.open(directory, { flag: "r" }), (handle) => handle.sync));
+const ioError = (method) => new KeyValueStore.KeyValueStoreError({
+	method,
+	key: "checkpoint",
+	message: `Checkpoint ${method} failed`
+});
+/** Private trusted root; the application owns cross-process exclusion. */
+const atomicFileStore = Effect.fnUntraced(function* (directory) {
+	const fs = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const digest = yield* Digest.Digest;
+	const random = yield* SecureRandom.SecureRandom;
+	const root = path.resolve(directory);
+	yield* Effect.gen(function* () {
+		const missing = [];
+		let ancestor = root;
+		while (!(yield* fs.exists(ancestor))) {
+			missing.push(ancestor);
+			if (path.dirname(ancestor) === ancestor) break;
+			ancestor = path.dirname(ancestor);
+		}
+		yield* fs.makeDirectory(root, {
+			recursive: true,
+			mode: 448
+		});
+		for (const created of missing) yield* syncDirectory(fs, created);
+		if (missing.length) yield* syncDirectory(fs, ancestor);
+	}).pipe(Effect.uninterruptible, Effect.mapError(() => ioError("make")));
+	const pathFor = (key) => Effect.map(digest.digestHex(Digest.sha256, new TextEncoder().encode(key)), (hash) => path.join(root, `checkpoint-${hash}.json`));
+	const filenames = fs.readDirectory(root).pipe(Effect.map((names) => names.filter((name) => /^checkpoint-[a-f0-9]{64}\.json$/u.test(name))));
+	return KeyValueStore.makeStringOnly({
+		keys: Effect.fail(ioError("keys")),
+		get: (key) => Effect.gen(function* () {
+			const filename = yield* pathFor(key);
+			const info = yield* fs.stat(filename);
+			if (ByteSize.toBigInt(info.size) > 64n * 1024n * 1024n) return yield* ioError("get");
+			return yield* fs.readFileString(filename);
+		}).pipe(Effect.catchReason("PlatformError", "NotFound", () => Effect.undefined), Effect.mapError(() => ioError("get"))),
+		set: (key, value) => Effect.gen(function* () {
+			const temporary = path.join(root, `.pending-${yield* random.uuidV4()}`);
+			const result = yield* Effect.scoped(Effect.gen(function* () {
+				const handle = yield* fs.open(temporary, {
+					flag: "wx",
+					mode: 384
+				});
+				yield* handle.writeAll(new TextEncoder().encode(value));
+				yield* handle.sync;
+			})).pipe(Effect.andThen(Effect.flatMap(pathFor(key), (destination) => fs.rename(temporary, destination))), Effect.andThen(syncDirectory(fs, root))).pipe(Effect.exit);
+			const cleanup = yield* fs.remove(temporary, { force: true }).pipe(Effect.result);
+			if (Exit.isFailure(result)) return yield* Effect.failCause(result.cause);
+			yield* Effect.fromResult(cleanup);
+		}).pipe(Effect.uninterruptible, Effect.mapError(() => ioError("set"))),
+		remove: (key) => pathFor(key).pipe(Effect.flatMap((filename) => fs.remove(filename, { force: true })), Effect.andThen(syncDirectory(fs, root)), Effect.uninterruptible, Effect.mapError(() => ioError("remove"))),
+		clear: Effect.gen(function* () {
+			for (const name of yield* filenames) yield* fs.remove(path.join(root, name));
+			yield* syncDirectory(fs, root);
+		}).pipe(Effect.uninterruptible, Effect.mapError(() => ioError("clear"))),
+		size: filenames.pipe(Effect.map((names) => names.length), Effect.mapError(() => ioError("size")))
+	});
+});
+
+export { atomicFileStore, syncDirectory };
+//# sourceMappingURL=filesystem.js.map

package/dist/runtime/filesystem.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"filesystem.js","names":[],"sources":["../../src/runtime/filesystem.ts"],"sourcesContent":["import { ByteSize, Effect, Exit, FileSystem, Path } from \"effect\";\nimport { Digest, SecureRandom } from \"effect/crypto\";\nimport { KeyValueStore } from \"effect/persistence\";\n\nexport const syncDirectory = (fs: FileSystem.FileSystem, directory: string) =>\n  Effect.scoped(Effect.flatMap(fs.open(directory, { flag: \"r\" }), (handle) => handle.sync));\n\nconst ioError = (method: string) =>\n  new KeyValueStore.KeyValueStoreError({\n    method,\n    key: \"checkpoint\",\n    message: `Checkpoint ${method} failed`,\n  });\n\n/** Private trusted root; the application owns cross-process exclusion. */\nexport const atomicFileStore = Effect.fnUntraced(function* (directory: string) {\n  const fs = yield* FileSystem.FileSystem;\n  const path = yield* Path.Path;\n  const digest = yield* Digest.Digest;\n  const random = yield* SecureRandom.SecureRandom;\n  const root = path.resolve(directory);\n\n  yield* Effect.gen(function* () {\n    const missing: string[] = [];\n    let ancestor = root;\n    while (!(yield* fs.exists(ancestor))) {\n      missing.push(ancestor);\n      if (path.dirname(ancestor) === ancestor) break;\n      ancestor = path.dirname(ancestor);\n    }\n    yield* fs.makeDirectory(root, { recursive: true, mode: 0o700 });\n    for (const created of missing) yield* syncDirectory(fs, created);\n    if (missing.length) yield* syncDirectory(fs, ancestor);\n  }).pipe(\n    Effect.uninterruptible,\n    Effect.mapError(() => ioError(\"make\")),\n  );\n\n  const pathFor = (key: string) =>\n    Effect.map(digest.digestHex(Digest.sha256, new TextEncoder().encode(key)), (hash) =>\n      path.join(root, `checkpoint-${hash}.json`),\n    );\n  const filenames = fs\n    .readDirectory(root)\n    .pipe(\n      Effect.map((names) => names.filter((name) => /^checkpoint-[a-f0-9]{64}\\.json$/u.test(name))),\n    );\n  return KeyValueStore.makeStringOnly({\n    // Hash filenames cannot reconstruct logical keys. Recovery uses known session IDs.\n    keys: Effect.fail(ioError(\"keys\")),\n    get: (key) =>\n      Effect.gen(function* () {\n        const filename = yield* pathFor(key);\n        const info = yield* fs.stat(filename);\n        if (ByteSize.toBigInt(info.size) > 64n * 1024n * 1024n) return yield* ioError(\"get\");\n        return yield* fs.readFileString(filename);\n      }).pipe(\n        Effect.catchReason(\"PlatformError\", \"NotFound\", () => Effect.undefined),\n        Effect.mapError(() => ioError(\"get\")),\n      ),\n    set: (key, value) =>\n      Effect.gen(function* () {\n        const temporary = path.join(root, `.pending-${yield* random.uuidV4()}`);\n        const result = yield* Effect.scoped(\n          Effect.gen(function* () {\n            const handle = yield* fs.open(temporary, { flag: \"wx\", mode: 0o600 });\n            yield* handle.writeAll(new TextEncoder().encode(value));\n            yield* handle.sync;\n          }),\n        )\n          .pipe(\n            Effect.andThen(\n              Effect.flatMap(pathFor(key), (destination) => fs.rename(temporary, destination)),\n            ),\n            Effect.andThen(syncDirectory(fs, root)),\n          )\n          .pipe(Effect.exit);\n        const cleanup = yield* fs.remove(temporary, { force: true }).pipe(Effect.result);\n        if (Exit.isFailure(result)) return yield* Effect.failCause(result.cause);\n        yield* Effect.fromResult(cleanup);\n      }).pipe(\n        Effect.uninterruptible,\n        Effect.mapError(() => ioError(\"set\")),\n      ),\n    remove: (key) =>\n      pathFor(key).pipe(\n        Effect.flatMap((filename) => fs.remove(filename, { force: true })),\n        Effect.andThen(syncDirectory(fs, root)),\n        Effect.uninterruptible,\n        Effect.mapError(() => ioError(\"remove\")),\n      ),\n    clear: Effect.gen(function* () {\n      for (const name of yield* filenames) yield* fs.remove(path.join(root, name));\n      yield* syncDirectory(fs, root);\n    }).pipe(\n      Effect.uninterruptible,\n      Effect.mapError(() => ioError(\"clear\")),\n    ),\n    size: filenames.pipe(\n      Effect.map((names) => names.length),\n      Effect.mapError(() => ioError(\"size\")),\n    ),\n  });\n});\n"],"mappings":";;;;;AAIA,MAAa,iBAAiB,IAA2B,cACvD,OAAO,OAAO,OAAO,QAAQ,GAAG,KAAK,WAAW,EAAE,MAAM,IAAI,CAAC,IAAI,WAAW,OAAO,IAAI,CAAC;AAE1F,MAAM,WAAW,WACf,IAAI,cAAc,mBAAmB;CACnC;CACA,KAAK;CACL,SAAS,cAAc,OAAO;AAChC,CAAC;;AAGH,MAAa,kBAAkB,OAAO,WAAW,WAAW,WAAmB;CAC7E,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,OAAO,OAAO,KAAK;CACzB,MAAM,SAAS,OAAO,OAAO;CAC7B,MAAM,SAAS,OAAO,aAAa;CACnC,MAAM,OAAO,KAAK,QAAQ,SAAS;CAEnC,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,UAAoB,CAAC;EAC3B,IAAI,WAAW;EACf,OAAO,EAAE,OAAO,GAAG,OAAO,QAAQ,IAAI;GACpC,QAAQ,KAAK,QAAQ;GACrB,IAAI,KAAK,QAAQ,QAAQ,MAAM,UAAU;GACzC,WAAW,KAAK,QAAQ,QAAQ;EAClC;EACA,OAAO,GAAG,cAAc,MAAM;GAAE,WAAW;GAAM,MAAM;EAAM,CAAC;EAC9D,KAAK,MAAM,WAAW,SAAS,OAAO,cAAc,IAAI,OAAO;EAC/D,IAAI,QAAQ,QAAQ,OAAO,cAAc,IAAI,QAAQ;CACvD,CAAC,CAAC,CAAC,KACD,OAAO,iBACP,OAAO,eAAe,QAAQ,MAAM,CAAC,CACvC;CAEA,MAAM,WAAW,QACf,OAAO,IAAI,OAAO,UAAU,OAAO,QAAQ,IAAI,YAAY,CAAC,CAAC,OAAO,GAAG,CAAC,IAAI,SAC1E,KAAK,KAAK,MAAM,cAAc,KAAK,MAAM,CAC3C;CACF,MAAM,YAAY,GACf,cAAc,IAAI,CAAC,CACnB,KACC,OAAO,KAAK,UAAU,MAAM,QAAQ,SAAS,mCAAmC,KAAK,IAAI,CAAC,CAAC,CAC7F;CACF,OAAO,cAAc,eAAe;EAElC,MAAM,OAAO,KAAK,QAAQ,MAAM,CAAC;EACjC,MAAM,QACJ,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,OAAO,QAAQ,GAAG;GACnC,MAAM,OAAO,OAAO,GAAG,KAAK,QAAQ;GACpC,IAAI,SAAS,SAAS,KAAK,IAAI,IAAI,MAAM,QAAQ,OAAO,OAAO,OAAO,QAAQ,KAAK;GACnF,OAAO,OAAO,GAAG,eAAe,QAAQ;EAC1C,CAAC,CAAC,CAAC,KACD,OAAO,YAAY,iBAAiB,kBAAkB,OAAO,SAAS,GACtE,OAAO,eAAe,QAAQ,KAAK,CAAC,CACtC;EACF,MAAM,KAAK,UACT,OAAO,IAAI,aAAa;GACtB,MAAM,YAAY,KAAK,KAAK,MAAM,YAAY,OAAO,OAAO,OAAO,GAAG;GACtE,MAAM,SAAS,OAAO,OAAO,OAC3B,OAAO,IAAI,aAAa;IACtB,MAAM,SAAS,OAAO,GAAG,KAAK,WAAW;KAAE,MAAM;KAAM,MAAM;IAAM,CAAC;IACpE,OAAO,OAAO,SAAS,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,CAAC;IACtD,OAAO,OAAO;GAChB,CAAC,CACH,CAAC,CACE,KACC,OAAO,QACL,OAAO,QAAQ,QAAQ,GAAG,IAAI,gBAAgB,GAAG,OAAO,WAAW,WAAW,CAAC,CACjF,GACA,OAAO,QAAQ,cAAc,IAAI,IAAI,CAAC,CACxC,CAAC,CACA,KAAK,OAAO,IAAI;GACnB,MAAM,UAAU,OAAO,GAAG,OAAO,WAAW,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,MAAM;GAC/E,IAAI,KAAK,UAAU,MAAM,GAAG,OAAO,OAAO,OAAO,UAAU,OAAO,KAAK;GACvE,OAAO,OAAO,WAAW,OAAO;EAClC,CAAC,CAAC,CAAC,KACD,OAAO,iBACP,OAAO,eAAe,QAAQ,KAAK,CAAC,CACtC;EACF,SAAS,QACP,QAAQ,GAAG,CAAC,CAAC,KACX,OAAO,SAAS,aAAa,GAAG,OAAO,UAAU,EAAE,OAAO,KAAK,CAAC,CAAC,GACjE,OAAO,QAAQ,cAAc,IAAI,IAAI,CAAC,GACtC,OAAO,iBACP,OAAO,eAAe,QAAQ,QAAQ,CAAC,CACzC;EACF,OAAO,OAAO,IAAI,aAAa;GAC7B,KAAK,MAAM,QAAQ,OAAO,WAAW,OAAO,GAAG,OAAO,KAAK,KAAK,MAAM,IAAI,CAAC;GAC3E,OAAO,cAAc,IAAI,IAAI;EAC/B,CAAC,CAAC,CAAC,KACD,OAAO,iBACP,OAAO,eAAe,QAAQ,OAAO,CAAC,CACxC;EACA,MAAM,UAAU,KACd,OAAO,KAAK,UAAU,MAAM,MAAM,GAClC,OAAO,eAAe,QAAQ,MAAM,CAAC,CACvC;CACF,CAAC;AACH,CAAC"}

package/dist/runtime/node-hash.d.ts

@@ -0,0 +1,4 @@
+import { TransferDigest } from "../transfers/models.js";
+/** Node's maintained streaming implementation; no whole-object WebCrypto buffering. */
+export declare const sha256: TransferDigest;
+//# sourceMappingURL=node-hash.d.ts.map

package/dist/runtime/node-hash.js

@@ -0,0 +1,31 @@
+import { createHash } from "node:crypto";
+
+// src/runtime/node-hash.ts
+/** Node's maintained streaming implementation; no whole-object WebCrypto buffering. */
+const sha256 = {
+	algorithm: "sha256",
+	workspaceBytes: 32768,
+	create: () => {
+		const hash = createHash("sha256");
+		return {
+			update: (bytes) => {
+				hash.update(bytes);
+			},
+			snapshot: () => ({
+				algorithm: "sha256",
+				encoding: "hex",
+				scope: "full-object",
+				value: hash.copy().digest("hex")
+			}),
+			finish: () => ({
+				algorithm: "sha256",
+				encoding: "hex",
+				scope: "full-object",
+				value: hash.digest("hex")
+			})
+		};
+	}
+};
+
+export { sha256 };
+//# sourceMappingURL=node-hash.js.map

package/dist/runtime/node-hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-hash.js","names":[],"sources":["../../src/runtime/node-hash.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\n\nimport type { TransferDigest } from \"../transfers/models.js\";\n\n/** Node's maintained streaming implementation; no whole-object WebCrypto buffering. */\nexport const sha256: TransferDigest = {\n  algorithm: \"sha256\",\n  workspaceBytes: 32768,\n  create: () => {\n    const hash = createHash(\"sha256\");\n    return {\n      update: (bytes) => {\n        hash.update(bytes);\n      },\n      snapshot: () => ({\n        algorithm: \"sha256\",\n        encoding: \"hex\",\n        scope: \"full-object\",\n        value: hash.copy().digest(\"hex\"),\n      }),\n      finish: () => ({\n        algorithm: \"sha256\",\n        encoding: \"hex\",\n        scope: \"full-object\",\n        value: hash.digest(\"hex\"),\n      }),\n    };\n  },\n};\n"],"mappings":";;;;AAKA,MAAa,SAAyB;CACpC,WAAW;CACX,gBAAgB;CAChB,cAAc;EACZ,MAAM,OAAO,WAAW,QAAQ;EAChC,OAAO;GACL,SAAS,UAAU;IACjB,KAAK,OAAO,KAAK;GACnB;GACA,iBAAiB;IACf,WAAW;IACX,UAAU;IACV,OAAO;IACP,OAAO,KAAK,KAAK,CAAC,CAAC,OAAO,KAAK;GACjC;GACA,eAAe;IACb,WAAW;IACX,UAAU;IACV,OAAO;IACP,OAAO,KAAK,OAAO,KAAK;GAC1B;EACF;CACF;AACF"}

package/dist/runtime/node-protection.d.ts

@@ -0,0 +1,4 @@
+import { CheckpointProtection } from "../sessions/store.js";
+import { Redacted } from "effect";
+export declare function aes256Gcm(key: Redacted.Redacted<Uint8Array>): CheckpointProtection;
+//# sourceMappingURL=node-protection.d.ts.map

package/dist/runtime/node-protection.js

@@ -0,0 +1,46 @@
+import { sessionError } from "../sessions/store.js";
+import { Effect, Redacted, Schema } from "effect";
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+
+// src/runtime/node-protection.ts
+const Ciphertext = Schema.Struct({
+	v: Schema.Literal(1),
+	iv: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9+/]{16}$/u)),
+	tag: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9+/]{22}==$/u)),
+	body: Schema.String.check(Schema.isMaxLength(67108864))
+});
+function aes256Gcm(key) {
+	const bytes = Uint8Array.from(Redacted.value(key));
+	return {
+		seal: (text, aad) => Effect.try({
+			try: () => {
+				if (bytes.length !== 32) throw new Error("Invalid key");
+				const iv = randomBytes(12);
+				const cipher = createCipheriv("aes-256-gcm", bytes, iv);
+				cipher.setAAD(Buffer.from(aad));
+				const encrypted = Buffer.concat([cipher.update(text, "utf8"), cipher.final()]);
+				return Redacted.make(JSON.stringify({
+					v: 1,
+					iv: iv.toString("base64"),
+					tag: cipher.getAuthTag().toString("base64"),
+					body: encrypted.toString("base64")
+				}));
+			},
+			catch: () => sessionError("CheckpointProtection")
+		}),
+		open: (encoded, aad) => Effect.try({
+			try: () => {
+				const value = Schema.decodeUnknownSync(Ciphertext)(JSON.parse(Redacted.value(encoded)));
+				if (value.v !== 1 || bytes.length !== 32) throw new Error("Invalid protection version");
+				const cipher = createDecipheriv("aes-256-gcm", bytes, Buffer.from(value.iv, "base64"));
+				cipher.setAAD(Buffer.from(aad));
+				cipher.setAuthTag(Buffer.from(value.tag, "base64"));
+				return Buffer.concat([cipher.update(Buffer.from(value.body, "base64")), cipher.final()]).toString("utf8");
+			},
+			catch: () => sessionError("CheckpointProtection")
+		})
+	};
+}
+
+export { aes256Gcm };
+//# sourceMappingURL=node-protection.js.map

package/dist/runtime/node-protection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-protection.js","names":[],"sources":["../../src/runtime/node-protection.ts"],"sourcesContent":["import { createCipheriv, createDecipheriv, randomBytes } from \"node:crypto\";\n\nimport { Effect, Redacted, Schema } from \"effect\";\n\nimport type { CheckpointProtection } from \"../sessions/store.js\";\nimport { sessionError } from \"../sessions/store.js\";\n\nconst Ciphertext = Schema.Struct({\n  v: Schema.Literal(1),\n  iv: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9+/]{16}$/u)),\n  tag: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9+/]{22}==$/u)),\n  body: Schema.String.check(Schema.isMaxLength(64 * 1024 * 1024)),\n});\n\nexport function aes256Gcm(key: Redacted.Redacted<Uint8Array>): CheckpointProtection {\n  const bytes = Uint8Array.from(Redacted.value(key));\n  return {\n    seal: (text, aad) =>\n      Effect.try({\n        try: () => {\n          if (bytes.length !== 32) throw new Error(\"Invalid key\");\n          const iv = randomBytes(12);\n          const cipher = createCipheriv(\"aes-256-gcm\", bytes, iv);\n          cipher.setAAD(Buffer.from(aad));\n          const encrypted = Buffer.concat([cipher.update(text, \"utf8\"), cipher.final()]);\n          return Redacted.make(\n            JSON.stringify({\n              v: 1,\n              iv: iv.toString(\"base64\"),\n              tag: cipher.getAuthTag().toString(\"base64\"),\n              body: encrypted.toString(\"base64\"),\n            }),\n          );\n        },\n        catch: () => sessionError(\"CheckpointProtection\"),\n      }),\n    open: (encoded, aad) =>\n      Effect.try({\n        try: () => {\n          const value = Schema.decodeUnknownSync(Ciphertext)(JSON.parse(Redacted.value(encoded)));\n          if (value.v !== 1 || bytes.length !== 32) throw new Error(\"Invalid protection version\");\n          const cipher = createDecipheriv(\"aes-256-gcm\", bytes, Buffer.from(value.iv, \"base64\"));\n          cipher.setAAD(Buffer.from(aad));\n          cipher.setAuthTag(Buffer.from(value.tag, \"base64\"));\n          return Buffer.concat([\n            cipher.update(Buffer.from(value.body, \"base64\")),\n            cipher.final(),\n          ]).toString(\"utf8\");\n        },\n        catch: () => sessionError(\"CheckpointProtection\"),\n      }),\n  };\n}\n"],"mappings":";;;;;AAOA,MAAM,aAAa,OAAO,OAAO;CAC/B,GAAG,OAAO,QAAQ,CAAC;CACnB,IAAI,OAAO,OAAO,MAAM,OAAO,UAAU,sBAAsB,CAAC;CAChE,KAAK,OAAO,OAAO,MAAM,OAAO,UAAU,wBAAwB,CAAC;CACnE,MAAM,OAAO,OAAO,MAAM,OAAO,YAAY,QAAgB,CAAC;AAChE,CAAC;AAED,SAAgB,UAAU,KAA0D;CAClF,MAAM,QAAQ,WAAW,KAAK,SAAS,MAAM,GAAG,CAAC;CACjD,OAAO;EACL,OAAO,MAAM,QACX,OAAO,IAAI;GACT,WAAW;IACT,IAAI,MAAM,WAAW,IAAI,MAAM,IAAI,MAAM,aAAa;IACtD,MAAM,KAAK,YAAY,EAAE;IACzB,MAAM,SAAS,eAAe,eAAe,OAAO,EAAE;IACtD,OAAO,OAAO,OAAO,KAAK,GAAG,CAAC;IAC9B,MAAM,YAAY,OAAO,OAAO,CAAC,OAAO,OAAO,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,CAAC;IAC7E,OAAO,SAAS,KACd,KAAK,UAAU;KACb,GAAG;KACH,IAAI,GAAG,SAAS,QAAQ;KACxB,KAAK,OAAO,WAAW,CAAC,CAAC,SAAS,QAAQ;KAC1C,MAAM,UAAU,SAAS,QAAQ;IACnC,CAAC,CACH;GACF;GACA,aAAa,aAAa,sBAAsB;EAClD,CAAC;EACH,OAAO,SAAS,QACd,OAAO,IAAI;GACT,WAAW;IACT,MAAM,QAAQ,OAAO,kBAAkB,UAAU,CAAC,CAAC,KAAK,MAAM,SAAS,MAAM,OAAO,CAAC,CAAC;IACtF,IAAI,MAAM,MAAM,KAAK,MAAM,WAAW,IAAI,MAAM,IAAI,MAAM,4BAA4B;IACtF,MAAM,SAAS,iBAAiB,eAAe,OAAO,OAAO,KAAK,MAAM,IAAI,QAAQ,CAAC;IACrF,OAAO,OAAO,OAAO,KAAK,GAAG,CAAC;IAC9B,OAAO,WAAW,OAAO,KAAK,MAAM,KAAK,QAAQ,CAAC;IAClD,OAAO,OAAO,OAAO,CACnB,OAAO,OAAO,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC,GAC/C,OAAO,MAAM,CACf,CAAC,CAAC,CAAC,SAAS,MAAM;GACpB;GACA,aAAa,aAAa,sBAAsB;EAClD,CAAC;CACL;AACF"}

package/dist/runtime/portable-hash.d.ts

@@ -0,0 +1,3 @@
+import { TransferDigest } from "../transfers/models.js";
+export declare const sha256: TransferDigest;
+//# sourceMappingURL=portable-hash.d.ts.map

package/dist/runtime/portable-hash.js

@@ -0,0 +1,31 @@
+import { sha256 } from "@noble/hashes/sha2.js";
+
+// src/runtime/portable-hash.ts
+const checksum = (bytes) => ({
+	algorithm: "sha256",
+	encoding: "hex",
+	scope: "full-object",
+	value: Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("")
+});
+const sha256$1 = {
+	algorithm: "sha256",
+	workspaceBytes: 32768,
+	create: () => {
+		const state = sha256.create();
+		return {
+			update: (bytes) => {
+				state.update(bytes);
+			},
+			snapshot: () => checksum(state.clone().digest()),
+			finish: () => checksum(state.digest())
+		};
+	}
+};
+const digestText = (text) => {
+	const state = sha256$1.create();
+	state.update(new TextEncoder().encode(text));
+	return state.finish().value;
+};
+
+export { digestText, sha256$1 as sha256 };
+//# sourceMappingURL=portable-hash.js.map

package/dist/runtime/portable-hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"portable-hash.js","names":["sha256","hash"],"sources":["../../src/runtime/portable-hash.ts"],"sourcesContent":["import { sha256 as hash } from \"@noble/hashes/sha2.js\";\n\nimport type { TransferDigest } from \"../transfers/models.js\";\n\nconst checksum = (bytes: Uint8Array) => ({\n  algorithm: \"sha256\",\n  encoding: \"hex\" as const,\n  scope: \"full-object\" as const,\n  value: Array.from(bytes, (byte) => byte.toString(16).padStart(2, \"0\")).join(\"\"),\n});\n\nexport const sha256: TransferDigest = {\n  algorithm: \"sha256\",\n  workspaceBytes: 32768,\n  create: () => {\n    const state = hash.create();\n    return {\n      update: (bytes) => {\n        state.update(bytes);\n      },\n      snapshot: () => checksum(state.clone().digest()),\n      finish: () => checksum(state.digest()),\n    };\n  },\n};\n\nexport const digestText = (text: string) => {\n  const state = sha256.create();\n  state.update(new TextEncoder().encode(text));\n  return state.finish().value;\n};\n"],"mappings":";;;AAIA,MAAM,YAAY,WAAuB;CACvC,WAAW;CACX,UAAU;CACV,OAAO;CACP,OAAO,MAAM,KAAK,QAAQ,SAAS,KAAK,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;AAChF;AAEA,MAAaA,WAAyB;CACpC,WAAW;CACX,gBAAgB;CAChB,cAAc;EACZ,MAAM,QAAQC,OAAK,OAAO;EAC1B,OAAO;GACL,SAAS,UAAU;IACjB,MAAM,OAAO,KAAK;GACpB;GACA,gBAAgB,SAAS,MAAM,MAAM,CAAC,CAAC,OAAO,CAAC;GAC/C,cAAc,SAAS,MAAM,OAAO,CAAC;EACvC;CACF;AACF;AAEA,MAAa,cAAc,SAAiB;CAC1C,MAAM,QAAQD,SAAO,OAAO;CAC5B,MAAM,OAAO,IAAI,YAAY,CAAC,CAAC,OAAO,IAAI,CAAC;CAC3C,OAAO,MAAM,OAAO,CAAC,CAAC;AACxB"}

package/dist/runtime/session-store.d.ts

@@ -0,0 +1,12 @@
+import "../index.js";
+import { SessionOwnership } from "../sessions/store.js";
+import { Effect, Layer, Redacted } from "effect";
+import { KeyValueStore } from "effect/persistence";
+export interface FileSessionStoreOptions {
+  readonly directory: string;
+  readonly namespace: string;
+  readonly key: Redacted.Redacted<Uint8Array>;
+  readonly ownership: "exclusive" | SessionOwnership;
+  readonly maximumCheckpointBytes?: number;
+}
+//# sourceMappingURL=session-store.d.ts.map

package/dist/runtime/session-store.js

@@ -0,0 +1,19 @@
+import { UploadSessionStore } from "../sessions/store.js";
+import { atomicFileStore } from "./filesystem.js";
+import { Effect, Layer } from "effect";
+import { KeyValueStore } from "effect/persistence";
+
+// src/runtime/session-store.ts
+const fileSessionStore = (options, protection) => Layer.effect(UploadSessionStore, Effect.gen(function* () {
+	const backing = yield* atomicFileStore(options.directory);
+	const codec = yield* protection;
+	return yield* UploadSessionStore.make({
+		namespace: options.namespace,
+		ownership: options.ownership,
+		protection: codec,
+		...options.maximumCheckpointBytes === void 0 ? {} : { maximumCheckpointBytes: options.maximumCheckpointBytes }
+	}).pipe(Effect.provideService(KeyValueStore.KeyValueStore, backing));
+}));
+
+export { fileSessionStore };
+//# sourceMappingURL=session-store.js.map

package/dist/runtime/session-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-store.js","names":[],"sources":["../../src/runtime/session-store.ts"],"sourcesContent":["import type { Redacted } from \"effect\";\nimport { Effect, Layer } from \"effect\";\nimport { KeyValueStore } from \"effect/persistence\";\n\nimport { UploadSessionStore } from \"../sessions/store.js\";\nimport type { CheckpointProtection, SessionOwnership } from \"../sessions/store.js\";\nimport { atomicFileStore } from \"./filesystem.js\";\n\nexport interface FileSessionStoreOptions {\n  readonly directory: string;\n  readonly namespace: string;\n  readonly key: Redacted.Redacted<Uint8Array>;\n  readonly ownership: \"exclusive\" | SessionOwnership;\n  readonly maximumCheckpointBytes?: number;\n}\n\nexport const fileSessionStore = <E, R>(\n  options: FileSessionStoreOptions,\n  protection: Effect.Effect<CheckpointProtection, E, R>,\n) =>\n  Layer.effect(\n    UploadSessionStore,\n    Effect.gen(function* () {\n      const backing = yield* atomicFileStore(options.directory);\n      const codec = yield* protection;\n      return yield* UploadSessionStore.make({\n        namespace: options.namespace,\n        ownership: options.ownership,\n        protection: codec,\n        ...(options.maximumCheckpointBytes === undefined\n          ? {}\n          : { maximumCheckpointBytes: options.maximumCheckpointBytes }),\n      }).pipe(Effect.provideService(KeyValueStore.KeyValueStore, backing));\n    }),\n  );\n"],"mappings":";;;;;;AAgBA,MAAa,oBACX,SACA,eAEA,MAAM,OACJ,oBACA,OAAO,IAAI,aAAa;CACtB,MAAM,UAAU,OAAO,gBAAgB,QAAQ,SAAS;CACxD,MAAM,QAAQ,OAAO;CACrB,OAAO,OAAO,mBAAmB,KAAK;EACpC,WAAW,QAAQ;EACnB,WAAW,QAAQ;EACnB,YAAY;EACZ,GAAI,QAAQ,2BAA2B,SACnC,CAAC,IACD,EAAE,wBAAwB,QAAQ,uBAAuB;CAC/D,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,cAAc,eAAe,OAAO,CAAC;AACrE,CAAC,CACH"}

package/dist/runtime/web-protection.d.ts

@@ -0,0 +1,7 @@
+import { StorageError } from "../core/errors.js";
+import "../index.js";
+import { CheckpointProtection } from "../sessions/store.js";
+import { Effect, Redacted } from "effect";
+import { Aead, SecureRandom } from "effect/crypto";
+export declare const aes256Gcm: (secret: Redacted.Redacted<Uint8Array<ArrayBufferLike>>) => Effect.Effect<CheckpointProtection, StorageError, Aead.Aead | SecureRandom.SecureRandom>;
+//# sourceMappingURL=web-protection.d.ts.map

package/dist/runtime/web-protection.js

@@ -0,0 +1,54 @@
+import { sessionError } from "../sessions/store.js";
+import { Effect, Redacted, Schema } from "effect";
+import { Aead, SecureRandom } from "effect/crypto";
+import { Base64 } from "effect/encoding";
+
+// src/runtime/web-protection.ts
+const Envelope = Schema.fromJsonString(Schema.Struct({
+	v: Schema.Literal(1),
+	iv: Schema.String,
+	tag: Schema.String,
+	body: Schema.String.check(Schema.isMaxLength(67108864))
+}));
+const utf8 = new TextEncoder();
+const aes256Gcm = Effect.fnUntraced(function* (secret) {
+	const cipher = yield* Aead.Aead;
+	const random = yield* SecureRandom.SecureRandom;
+	const key = yield* Aead.key(Aead.aes256Gcm, Redacted.value(secret)).pipe(Effect.mapError(() => sessionError("CheckpointProtection")));
+	return {
+		seal: (plaintext, aad) => Effect.gen(function* () {
+			const nonce = yield* random.randomBytes(12);
+			const bytes = yield* cipher.encrypt(key, utf8.encode(plaintext), {
+				nonce,
+				aad: utf8.encode(aad)
+			});
+			return Redacted.make(JSON.stringify({
+				v: 1,
+				iv: Base64.encode(nonce),
+				tag: Base64.encode(bytes.subarray(-16)),
+				body: Base64.encode(bytes.subarray(0, -16))
+			}));
+		}).pipe(Effect.mapError(() => sessionError("CheckpointProtection"))),
+		open: (encoded, aad) => Effect.gen(function* () {
+			const envelope = yield* Schema.decodeUnknownEffect(Envelope)(Redacted.value(encoded));
+			const nonce = yield* Effect.fromResult(Base64.decode(envelope.iv));
+			const body = yield* Effect.fromResult(Base64.decode(envelope.body));
+			const tag = yield* Effect.fromResult(Base64.decode(envelope.tag));
+			if (tag.length !== 16) return yield* sessionError("CheckpointProtection");
+			const ciphertext = new Uint8Array(body.length + tag.length);
+			ciphertext.set(body);
+			ciphertext.set(tag, body.length);
+			const plaintext = yield* cipher.decrypt(key, ciphertext, {
+				nonce,
+				aad: utf8.encode(aad)
+			});
+			return yield* Effect.try({
+				try: () => new TextDecoder("utf-8", { fatal: true }).decode(plaintext),
+				catch: () => sessionError("CheckpointProtection")
+			});
+		}).pipe(Effect.mapError(() => sessionError("CheckpointProtection")))
+	};
+});
+
+export { aes256Gcm };
+//# sourceMappingURL=web-protection.js.map

package/dist/runtime/web-protection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-protection.js","names":[],"sources":["../../src/runtime/web-protection.ts"],"sourcesContent":["import { Effect, Redacted, Schema } from \"effect\";\nimport { Aead, SecureRandom } from \"effect/crypto\";\nimport { Base64 } from \"effect/encoding\";\n\nimport type { CheckpointProtection } from \"../sessions/store.js\";\nimport { sessionError } from \"../sessions/store.js\";\n\nconst Envelope = Schema.fromJsonString(\n  Schema.Struct({\n    v: Schema.Literal(1),\n    iv: Schema.String,\n    tag: Schema.String,\n    body: Schema.String.check(Schema.isMaxLength(64 * 1024 * 1024)),\n  }),\n);\nconst utf8 = new TextEncoder();\n\nexport const aes256Gcm = Effect.fnUntraced(function* (secret: Redacted.Redacted<Uint8Array>) {\n  const cipher = yield* Aead.Aead;\n  const random = yield* SecureRandom.SecureRandom;\n  const key = yield* Aead.key(Aead.aes256Gcm, Redacted.value(secret)).pipe(\n    Effect.mapError(() => sessionError(\"CheckpointProtection\")),\n  );\n  const protection: CheckpointProtection = {\n    seal: (plaintext, aad) =>\n      Effect.gen(function* () {\n        const nonce = yield* random.randomBytes(12);\n        const bytes = yield* cipher.encrypt(key, utf8.encode(plaintext), {\n          nonce,\n          aad: utf8.encode(aad),\n        });\n        return Redacted.make(\n          JSON.stringify({\n            v: 1,\n            iv: Base64.encode(nonce),\n            tag: Base64.encode(bytes.subarray(-16)),\n            body: Base64.encode(bytes.subarray(0, -16)),\n          }),\n        );\n      }).pipe(Effect.mapError(() => sessionError(\"CheckpointProtection\"))),\n    open: (encoded, aad) =>\n      Effect.gen(function* () {\n        const envelope = yield* Schema.decodeUnknownEffect(Envelope)(Redacted.value(encoded));\n        const nonce = yield* Effect.fromResult(Base64.decode(envelope.iv));\n        const body = yield* Effect.fromResult(Base64.decode(envelope.body));\n        const tag = yield* Effect.fromResult(Base64.decode(envelope.tag));\n        if (tag.length !== 16) return yield* sessionError(\"CheckpointProtection\");\n        const ciphertext = new Uint8Array(body.length + tag.length);\n        ciphertext.set(body);\n        ciphertext.set(tag, body.length);\n        const plaintext = yield* cipher.decrypt(key, ciphertext, { nonce, aad: utf8.encode(aad) });\n        return yield* Effect.try({\n          try: () => new TextDecoder(\"utf-8\", { fatal: true }).decode(plaintext),\n          catch: () => sessionError(\"CheckpointProtection\"),\n        });\n      }).pipe(Effect.mapError(() => sessionError(\"CheckpointProtection\"))),\n  };\n  return protection;\n});\n"],"mappings":";;;;;;AAOA,MAAM,WAAW,OAAO,eACtB,OAAO,OAAO;CACZ,GAAG,OAAO,QAAQ,CAAC;CACnB,IAAI,OAAO;CACX,KAAK,OAAO;CACZ,MAAM,OAAO,OAAO,MAAM,OAAO,YAAY,QAAgB,CAAC;AAChE,CAAC,CACH;AACA,MAAM,OAAO,IAAI,YAAY;AAE7B,MAAa,YAAY,OAAO,WAAW,WAAW,QAAuC;CAC3F,MAAM,SAAS,OAAO,KAAK;CAC3B,MAAM,SAAS,OAAO,aAAa;CACnC,MAAM,MAAM,OAAO,KAAK,IAAI,KAAK,WAAW,SAAS,MAAM,MAAM,CAAC,CAAC,CAAC,KAClE,OAAO,eAAe,aAAa,sBAAsB,CAAC,CAC5D;CAmCA,OAAO;EAjCL,OAAO,WAAW,QAChB,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,OAAO,YAAY,EAAE;GAC1C,MAAM,QAAQ,OAAO,OAAO,QAAQ,KAAK,KAAK,OAAO,SAAS,GAAG;IAC/D;IACA,KAAK,KAAK,OAAO,GAAG;GACtB,CAAC;GACD,OAAO,SAAS,KACd,KAAK,UAAU;IACb,GAAG;IACH,IAAI,OAAO,OAAO,KAAK;IACvB,KAAK,OAAO,OAAO,MAAM,SAAS,GAAG,CAAC;IACtC,MAAM,OAAO,OAAO,MAAM,SAAS,GAAG,GAAG,CAAC;GAC5C,CAAC,CACH;EACF,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,aAAa,sBAAsB,CAAC,CAAC;EACrE,OAAO,SAAS,QACd,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,OAAO,OAAO,oBAAoB,QAAQ,CAAC,CAAC,SAAS,MAAM,OAAO,CAAC;GACpF,MAAM,QAAQ,OAAO,OAAO,WAAW,OAAO,OAAO,SAAS,EAAE,CAAC;GACjE,MAAM,OAAO,OAAO,OAAO,WAAW,OAAO,OAAO,SAAS,IAAI,CAAC;GAClE,MAAM,MAAM,OAAO,OAAO,WAAW,OAAO,OAAO,SAAS,GAAG,CAAC;GAChE,IAAI,IAAI,WAAW,IAAI,OAAO,OAAO,aAAa,sBAAsB;GACxE,MAAM,aAAa,IAAI,WAAW,KAAK,SAAS,IAAI,MAAM;GAC1D,WAAW,IAAI,IAAI;GACnB,WAAW,IAAI,KAAK,KAAK,MAAM;GAC/B,MAAM,YAAY,OAAO,OAAO,QAAQ,KAAK,YAAY;IAAE;IAAO,KAAK,KAAK,OAAO,GAAG;GAAE,CAAC;GACzF,OAAO,OAAO,OAAO,IAAI;IACvB,WAAW,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,OAAO,SAAS;IACrE,aAAa,aAAa,sBAAsB;GAClD,CAAC;EACH,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,aAAa,sBAAsB,CAAC,CAAC;CAEvD;AAClB,CAAC"}